When Environment Variables Met Steganography: Inside a Reusable DCRat Delivery Chain

During the analysis of a recent malware sample, SentinelOne identified an anomalous execution chain, characterized by the combination of environment variable staging and steganographic payload delivery, culminating in the execution of a credential-stealing payload. Introduction Sometimes the most suspicious files are the ones that look the least suspicious. This attack chain begins with what appears to be a simple image download.